Method and system for managing a protective distribution system

ABSTRACT

A method and system for managing a protective distribution system is disclosed. In some embodiments, a physical information transmission line may be monitored. A disturbance on the physical information transmission line may be detected. The detected disturbance may not exceed a first preset threshold for triggering alerts of a first alert type based on detected disturbances. Responsive to the detection, a count for the number of disturbances within a preset time period that do not exceed the first preset threshold may be determined. A determination of whether the count, for the number of disturbances that do not exceed the first preset threshold, exceeds a second preset threshold may be effectuated. The second preset threshold may correspond to a preset number of allowable disturbances within the preset time period. An alert of the first alert type may be triggered responsive to a determination that the count exceeds the second preset threshold.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.14/849,746, filed Sep. 10, 2015, which is a continuation of U.S. patentapplication Ser. No. 14/217,259, filed Mar. 17, 2014, which claims thebenefit of U.S. Provisional Application Ser. No. 61/786,460 filed onMar. 15, 2013, each of which is incorporated by reference herein in itsentirety.

FIELD OF INVENTION

The present invention relates to monitoring an information transmissionline and, more particularly, to a method and system for managing aprotective distribution system.

BACKGROUND

The protection of sensitive data has traditionally been focused on dataencryption and physical security carriers (conduits) that house ITinfrastructure cabling. An example of an encryption device is a TACLANE(short for “Tactical FASTLANE” or Tactical Local Area NetworkEncryption). A TACLANE is a network encryption device developed by theNational Security Agency (NSA) to provide network communicationssecurity on Internet Protocol (IP) and Asynchronous Transfer Mode (ATM)networks for the individual user or for enclaves of users at the samesecurity level. An example of a physical security carrier is aProtective Distribution System (PDS). A PDS is a wireline orfiber-optics telecommunication system that includes terminals andadequate acoustical, electrical, electromagnetic, and physicalsafeguards to permit its use for the unencrypted transmission ofclassified information. PDS systems are not managed via software,thereby leaving the intrusion detection process and information trackingup to paper logs and human inspections once every 24 hours. When anintrusion is detected it is completely unknown what type of informationwas taken during the 24 hours between inspections. The lack of softwaremanagement and the protection of sensitive data infrastructures havebeen and continue to be vulnerabilities. These and other drawbacksexist.

SUMMARY

Various embodiments as described herein solve these and other problemsby providing methods and systems for protective distribution system(PDS) and infrastructure protection and management.

In a first aspect of the invention, a method for managing an informationtransmission line is disclosed. In one embodiment, the method includesmonitoring an information transmission line, detecting a disturbance onthe information transmission line, displaying the disturbance as agraphical representation, comparing the disturbance to a presetthreshold, and triggering an alert if the disturbance is greater thanthe preset threshold or the number of disturbances less than the presetthreshold meets a preset number within a preset time period.

In a second aspect of the invention, a computer-readable medium forstoring computer instructions comprising instructions for managing aninformation transmission line is disclosed. In one embodiment, thecomputer-readable medium comprises a set of instructions to perform amethod for managing an information transmission line. The methodincludes monitoring an information transmission line, detecting adisturbance on the information transmission line, displaying thedisturbance as a graphical representation, comparing the disturbance toa preset threshold, and triggering an alert if the disturbance isgreater than the preset threshold or the number of disturbances lessthan the preset threshold meets a preset number within a preset timeperiod.

In a third aspect of the invention, a system for managing an informationtransmission line is disclosed. In one embodiment, the system includes acomputer having a set of instructions which when executed causes aprocessor to perform a method for managing an information transmissionline. The method includes monitoring an information transmission line,detecting a disturbance on the information transmission line, displayingthe disturbance as a graphical representation, comparing the disturbanceto a preset threshold, and triggering an alert if the disturbance isgreater than the preset threshold or the number of disturbances lessthan the preset threshold meets a preset number within a preset timeperiod. The system further includes an intrusion detector, an opticalline terminal and/or network switch, an optical circuit switch, anoptical test access point device, and a network analytic tool.

These and other aspects of the present patent application, as well asthe methods of operation and functions of the related elements ofstructure and the combination of parts and economies of manufacture,will become more apparent upon consideration of the followingdescription and the appended claims with reference to the accompanyingdrawings, all of which form a part of this specification, wherein likereference numerals designate corresponding parts in the various figures.It is to be expressly understood that the drawings are for the purposeof illustration and description only and are not intended as adefinition of the limits of the present patent application. It shallalso be appreciated that the features of one embodiment disclosed hereincan be used in other embodiments disclosed herein. As used in thespecification and in the claims, the singular form of “a”, “an”, and“the” include plural referents unless the context clearly dictatesotherwise.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram showing a system architecture;

FIG. 2 is a block diagram showing an overview of an exemplary PDS and ITinfrastructure management system;

FIG. 3 is a screenshot of a dashboard;

FIG. 4 is a screenshot of a zone screen;

FIG. 5 is a flowchart for monitoring alerts;

FIG. 6 is a screen shot of a fiber forensic graphical display;

FIG. 7 is a flowchart for processing alerts;

FIG. 8 is a flowchart of a trunk cable processing subprocess;

FIG. 9 is a flowchart of a create alarm subprocess;

FIG. 10 is a flowchart for a process to disable data;

FIG. 11 is a flowchart for processing open warnings;

FIG. 12 is a chart showing a process for case resolution;

FIG. 13 is a screen shot of a case detail screen; and

FIG. 14 is a flowchart for continued monitoring during case management.

DETAILED DESCRIPTION

All publications, patents, and patent applications cited in thisspecification are hereby incorporated by reference in their entirety.The detailed description provided below in connection with the appendeddrawings is intended as a description of exemplary embodiments and isnot intended to represent the only forms in which the invention may beconstructed or utilized. The same or equivalent functions and sequencesmay be accomplished by different embodiments as will be appreciated bythose skilled in the art.

FIG. 1 illustrates a block diagram of a system 100 according to anembodiment. System 100 may be used to provide proactive real-time alarmmonitoring of dark fiber intrusions and may distribute notification ofalarms of suspected tampering to a variety of endpoints. System 100 mayinclude a manager engine 101, a manager database server 102, a managerweb server 103, and a manager engine listener 104. In an embodiment,system 100 may include one or more components that functions as any ofthe manager engine, manager database server, manager web server, andmanager engine listener.

System 100 may integrate with a variety of network devices to offeralarm detection and alarm response capabilities in a consolidatedsystem. In an embodiment, system 100 may integrate with Passive OpticalNetwork (PON) equipment, Optical Circuit Switch equipment, Optical TestAccess Point equipment, and Network Analyzers to stop and start dataflow to network endpoints, re-route data flow, and record or furtheranalyze data when alarms are detected and resolved. Alarm events may becaptured in a case management oriented workflow for auditing andanalytics.

System 100 may provide the ability for complete network mapping ofcomponents starting from a source Optical Line Terminal (OLT) down to anend user Optical Network Terminal (ONT). Network components may beenrolled and maintained in system 100 in a logical and efficient manner.System views and reports may be leveraged to inspect an entire networkas well as each data run.

System 100 may handle the coordination of tasks between dark fiber alarmmonitoring devices and PON equipment through backend adapters leveragingSimple Network Management Protocol (SNMP) traps and Secure Shell (SSH)protocols. System 100 may be monitored actively and passively to assureevents are not missed.

System 100 may offer a secure web user interface to provide networkoperations center (NOC) oriented dashboards for proactive monitoring.Notification of events may be handled in a guaranteed delivery mannerover SMTP and HTTP to assure best effort notification to a targetedendpoint so first responders can focus on the status of the remainingsystem. Maps and images may be immediately provided with floor planlayouts overlaid with network diagrams for an alarmed area to reducecritical decision times for resolving alarms. System 100 may allow staffto identify a suspected intrusion event, isolate its location, notifyresponder groups, execute planned remediation, and track its history.

In an embodiment, system 100 offers a warning threshold technology tosuppress the occurrence of nuisance alarms. A configurable threshold mayallow system 100 to filter out accidental or environmental disturbancesfrom actual intrusion attempts.

System 100 may integrate into an existing enterprise by providingconsolidated alerts to ‘north-bound’ systems over SNMP. System 100 mayalso integrate with any existing Active Directory authentication systemto assure its operation is consistent with pre-established IT securitypolicies and site practices. System 100 may be supported by a relationaldatabase to provide redundancy, durability, recovery protection, andtools for data extraction and analysis.

In an embodiment, system 100 may provide health reports by providinganalytics and reporting on all warnings and alarms captured by system100. System 100 may provide trend reporting and predictive analysis.System 100 may publish and disseminate the results of the analysis to aconfigurable group of users at a configurable time period and frequency.

In an embodiment, system 100 may provide infrastructure management forPON Systems. System 100 may provide a graphical and textual depiction ofan end to end path for a circuit. For example, one end may start from aport on an optical line terminal and/or network switch joined with aport on an intrusion detector then continue to an optical circuit switchthen continue through a trunk cable then continue to a splitter thencontinue to a zone box then continue to a fiber run to an user area thencontinue to a user end device, such as an optical network terminal. Eachof the devices, passive or active, and each cable run may be representedin the system graphically and textually.

System 100 may provide the ability to add, modify, or deleterepresentative circuit paths. System 100 may track device types,identification numbers, and locations for each device. System 100 maydisplay each circuit path overlaid on a physical diagram, such as abuilding or floor computer-aided design (CAD) diagram. System 100 mayprovide querying and reporting capabilities for each device. System 100may highlight a circuit path when displayed in a graphical view.

Turning to FIG. 2, a schematic diagram showing an overview of a PDS andinformation technology (IT) infrastructure management system accordingto an embodiment is shown. In one embodiment, system 200 may be system100 described above. In one embodiment, system 200 may manage anintrusion detector 202, which monitors a building 201. System 200 mayprovide the ability to receive alerts when intrusion detector 202detects intrusion attempts. System 200 may also provide the ability tomanage certain features of intrusion detector 202. As will be explainedin greater detail below, such features may include learning mode,configuration, enabling and disabling monitoring on a channel port, andreading and updating a threshold setting. Exemplary intrusion detectorsthat system 200 may integrate with are Network Integrity Systems'INTERCEPTOR, VANGUARD, and INTERCEPTOR LD2.

In one embodiment, system 200 tracks a floor 203 of building 201 that ismonitored by intrusion detector 202. Each monitored floor 203 maycontain one or more zone groups 204. Within each zone group 204 may be acollection of zones 205, each of which may correspond to a singlechannel port 206 on intrusion detector 202. Though not depicted in thefigure, system 200 may also be used to manage a collection of campuses,each of which may contain a collection of buildings.

System 200 may manage a collection of intrusion detectors 202. Intrusiondetector 202 may contain a channel port 206, which corresponds to a zone205. A zone 205 correlates to a physical location that is beingmonitored by system 200. A zone 205 may have an image 207, which mayinclude computer-aided design drawings, first person perspective images,or video, to aid users in inspections. A zone 105 may also be associatedwith a contact personnel 208. Contact personnel 208 may be notified inthe event of an intrusion attempt.

System 200 may be configured so that a zone 205 has a data port address209 associated with the zone to integrate with a data providingnetworking equipment, such as an optical circuit switch or optical lineterminal and/or network switch. In the event of an intrusion attempt inzone 205, system 200 may disable or re-route data by sending a commandto a networking equipment using data port address 209. System 200provides the ability to enable or disable data on a specific port andalso provide the ability to read and update details for a port. Someexample devices that system 200 may integrate with are Tellabs PON,Zhone PON, and Motorola POL.

Zone 205 may also have a physical security device address 210 associatedwith the zone. In the event of an intrusion attempt in zone 205, system200 may adjust physical security including locking doors, recording onIP based cameras, etc. by sending a command to physical security address210.

System 200 may also manage an optical circuit switch 211. Opticalcircuit switch 211 may provide the ability to disable, enable, orre-route an optical transmission. Optical circuit switch 211 may have anoptical line terminal and/or network switch 212. Optical line terminaland/or network switch 212 may convert and provide a fiber optical signalto a data network. System 200 may also provide the ability to perform abulk enrollment of a cross connect defined during initial installationor subsequent reconfiguration. An example device that system 200 mayintegrate with is the Calient S320 or CyberSecure Cyber Patch Panel.

Optical circuit switch 211 may have an optical test access point 213.Optical test access point 213 may allow system 200 to provide an abilityto route or copy network data. Optical test access point 213 may deliveran identical copy of network traffic to a network analytic tool, such asa network monitor 214, a security monitor 215, a network recorder 216, anetwork analyzer 217, and other analytic tools. An example of an opticaltest access point device that system 200 may integrate with is theMimetrix OpticalTAP.

Turning to FIG. 3, a dashboard 300 according to an embodiment is shown.Dashboard 300 may provide a consolidate view from a system and allownetwork personnel to determine the health of a network with multiplevisual indicators.

Intrusion detectors panel 301 may display a list of all intrusiondetectors managed by a system. Each intrusion detector displays acolored icon for a channel port. The colored icons may correlate to alabel provided in legend 307. Each intrusion detector may be associatedwith a unique label, which may include information such as a userdefined name, IP Address, etc. The background for the intrusion detectoras shown in intrusion detector panel 301 may be programmed to changeaccording to the status of the intrusion detector. For example, thebackground for an intrusion detector with a channel port in an alarmedstate may be colored red. The list of intrusion detectors may befiltered to a building specific intrusion detector when a building isselected in a building drop down list 308 or when a building icon isselected in a map view panel 302.

Map view panel 302 may be configured to display a map image with visualindicators for a building managed by a system. The location of thevisual indicators may be based on the geographic coordinates of abuilding. The color of the visual indicator may provide a combinedstatus for each of the intrusion detector's channel ports managed in abuilding. According to one embodiment, the background colors may bedetermined in the following hierarchy:

-   -   If one or more channel ports are in an alarmed state, the color        will be red.    -   If one or more channel ports are in a warning state and none are        in an alarmed state, the color will be yellow.    -   If no channel ports are in an alarmed or a warning state, the        color will be green.

Building list 308 may contain the building names for all of thebuildings managed by a system. Building list 308 may be set to a defaultoption, e.g. option ‘A1’, if there are multiple buildings managed by asystem. Otherwise, the list may default to a single building managed bya system. When a user selects a building, a system may filter a list ofintrusion detectors in intrusion detector panel 301 to only show thedevices managed in the selected building.

An incident log panel 303 may display a list of events captured orenacted by a system in response to an alert. In one embodiment, incidentlog panel 303 may display Incident Date, Room Name, Intrusion DetectorName, Zone Name, and Incident Message for an incident. An incident logmay contain the most recent incidents for a given time parameter whichmay be configured in a system.

A summary report panel 304 may display a total number of zones monitoredby a system. Also included may be the number of active alarms in asystem as well as the number of active warnings. Summary report panel304 may also include a chart of all warnings and alarms captured by asystem in a specified time period, such as the last 7 days or the last30 days.

An open incidents panel 305 may include a list of open cases. Openincidents panel 305 may list the ID, Date Opened, and Status for an opencase.

An active warnings panel 306 may include a list of all open and activewarnings. As will be described in more detail below, active warnings maybe set when a set number of disturbances or alerts are captured in adefined amount of time before reaching a configured alarm threshold. Theactive warning feature may be known as a Zonar Warning System, a VisualActive Alert Indicator. Active warnings panel 306 may also display agraphical chart to show the number of disturbances or alerts captured bya system for a given zone as well as the alarm threshold level for thegiven zone. When there are no active incidents, a system may display thelast number of warning events on the screen, such as the last 5 warningevents.

Turning to FIG. 4, a zone screen display 400 according to an embodimentis shown. Zone screen display 400 may show a live representative view ofa zone monitored by an intrusion detector. Zone screen display 400 mayshow a gauge 401, which may be known as a Zonar Warning Gauge, whichdisplays a current active warning count received by a zone and a currentpower level reading for a zone. In the event of receiving an alert, zonescreen display 400 may show the current alert count and the numericalarm threshold value by displaying the values in a gauge 401.Similarly, in the event of receiving an alert, zone screen display 400may show the severity of the alert by displaying a disturbance level ina power meter icon 402.

In one embodiment, power meter icon 402 may display the followinglevels:

-   -   Minor—based on a configurable threshold on a lower end of a        disturbance spectrum.    -   Moderate—based on a configurable threshold in between a Minor        and a Major threshold.    -   Major—based on a configurable threshold on a higher end of a        disturbance spectrum.    -   Critical—indicates a boundary alarm, which may occur when a        cable is damaged or removed from an intrusion detector port.

Zone screen display 400 may also show a media 403 related to a zone.Media 403 may be in an image, video, or document format. A system mayallow users with the appropriate privileges to add or remove a zonemedia and enter the required descriptive text for each media item. Zonescreen display 400 may include additional section 404 to displayinformation such as status of the zone, time of last alarm,alarm/warnings in the past 24 hours/7 days/30 days, and notificationlist for the zone.

Turning to FIG. 5, a flowchart for creating an alert 500 according to anembodiment is shown. In 501, an intrusion detector monitors a fiberoptic cable. In one embodiment, monitoring may be performed by comparinga light transmitted to a light received in order to detect if adisturbance has occurred. In other embodiments, monitoring may beperformed on vibration readings, frequency readings, changes in dB,optical time-domain reflectometer (OTDR), acoustic readings, distancedetermination based on reflective sensors, or combinations thereof. Whena disturbance is detected, the disturbance may be compared to a definedthreshold in 502. If the disturbance is less than the defined threshold,the intrusion detector may return to monitoring a fiber optic cable in501. If the disturbance is greater than a defined threshold, theintrusion detector may send an alert to a target based on a configuredsetting.

In one embodiment, in 503 and 504, an intrusion detector configured tosend simple network management protocol (SNMP) traps may send SNMP trapsto configured targets. In 505 and 506, an intrusion detector configuredto send Syslog entries may send Syslog entries to configured targets.

In one embodiment, a detected disturbance may be presented to a user asa graphical representation. FIG. 6 shows a screen shot of one embodimentof a graphical representation of detected disturbances. Graph 601 showsa detected disturbance as a function of time. The graphical points maybe plotted based on the level of dB difference registered on thetransmission line during the disturbance and represented accordinglywith a unique graphical icon. Additional graphical points may be plottedbased on vibration and acoustic calculations registered on thetransmission line during the disturbance and represented accordinglywith a unique graphical icon. Summary section 602 shows differentcharacteristics of the detected disturbances. The graphicalrepresentation may include time characteristics of the detecteddisturbance including the start time, end time, and total duration ofthe detected disturbance. The graphical representation may includedisturbance characteristics of the detected disturbance including themaximum optical loss measured in dB, the number of registered vibrationor acoustic events, the detection of cable damage, and the total numberof distinct disturbances. The graphical representation may be used by auser to determine whether an immediate alarm response is required andwhich alarm response team member would be able to perform the on-siteinspection. Similarly, the graphical representation may be used toindicate to the user where to perform the onsite inspection first. Thegraphical representation showing a short duration with fluctuating dBloss may indicate that inspection starts where the transmission line isreadily exposed such as in a telecommunications closet. The graphicalrepresentation showing a long duration starting with many vibration oracoustic disturbances followed by multiple fluctuating dB lossdisturbances may indicate an injection of an optical tap and that theinspection include a visual inspection of the entire transmission line.The graphical representation showing optical signatures indicative ofaccidental contact with a low severity would be represented accordingly.Similarly, optical signatures of a sever event such as the insertion ofa fiber optic tap would be represented accordingly. While the graphicalrepresentation shown in FIG. 6 and described herein depicts an exemplarygraphical representation of the detected disturbance, other graphicalrepresentations arranged with different plot points may be implementedbased on different interfaces with various intrusion detection hardware.

In FIG. 7, a flowchart for alert processing 700 by a system according toan embodiment is shown. In 701, a system may keep an open port to listenfor an alert. In 702, the system determines if an alert has beenreceived by a target. If an alert has been received, the systemtranslates the alert to determine a zone number for the alert. In 703,the system determines if the alert is a boundary alarm. Boundary alarmsmay be classified as critical severity. If the alert is a boundaryalarm, the system creates an alarm as defined in ‘create alarm’ subprocess 900.

If the system determines that the alert is not a boundary alarm in 703,the system may check in 704 to see if multiple warnings above a definedthreshold or criteria in a have been received in a defined period oftime. For example, the system may check to see if there have been 3other previous warnings occurring within the past 24 hours for the zone.If the zone does have multiple warnings that meet a defined criteria,the system creates an alarm as defined in ‘create alarm’ sub process900.

If the system determines in 704 that the zone has not have multiplewarnings that meet a defined criteria, the system may check to see ifthe zone has an active warning counter in 705. The system creates a newwarning counter for a zone in 706 if the zone does not have an activewarning counter. If the zone does have an active warning counter, thesystem opens the warning counter in 707. With an active warning counteridentified for the zone, the system increments the warning count for thezone in 708. In 709, the system determines the status of the zone. Ifthe zone is in a warning mode, the system proceeds to a trunk cableprocessing sub process 800. A warning mode may be defined as a warningcount of greater than 1. If the zone is not in a warning mode, thesystem sets the zone to a warning status in 710 and then proceeds to‘trunk cable processing’ sub process 800.

In one embodiment, the system evaluates trunk cable processing in a‘trunk cable processing’ sub process 800. After the trunk cableprocessing sub process, the system moves on to 711 to determine if thewarning count exceeds the defined threshold for the zone. If the warningcount exceeds the defined threshold for the zone, the system creates analarm in ‘create alarm’ sub process 900 and then returns to 701 tolisten for alerts. If the warning count does not exceed the definedthreshold for the zone, the system returns to 701 to listen for alerts.While the flowchart shown in FIG. 7 and described herein depicts anexemplary workflow for processing an alert, other workflows arranged ina different order may be implemented.

In FIG. 8, a flowchart for ‘trunk cable processing’ sub process 800according to an embodiment is shown. In 801, a system determines if thezone is a trunk zone. In one embodiment, a trunk zone may be defined asa zone that includes a trunk cable. A trunk cable may be co-bundled withmonitoring cables for each floor. At each floor, the cables dedicated tothat floor may distribute out to the floors. A trunk cable and remainingfloor cables may continue down a riser closet (e.g. communicationnetwork closets that traverse up and down an area of a building). Havinga dedicated trunk zone that may be monitored by a system may allow for alogical separation of user zones (e.g. network cables distributing datathroughout a floor of a building) from a riser closet and a sourcecloset (e.g. place where network data for a building originates).Without a trunk cable, on an intrusion or disturbance, an investigatormay be required to inspect an entire user zone and then back up a risercloset and back to a source closet. Logical separation may allow formeeting an inspection requirement, such as an inspection being requiredwithin 15 minute of an alert.

If the zone is a trunk zone, the system proceeds to 809 to evaluate thealert as a standard zone and returns to step 711 as described above. Ifthe zone is not a trunk zone, the system continues to 802 to determineif the trunk zone is in a warning or an alarmed status. If the system isnot in a warning or alarmed status, the system proceeds to 809 toevaluate the alert as a standard zone and returns to step 711 asdescribed above. If the trunk zone is in a warning or an alarmed status,the system proceeds to 803 and determines if a warning time period hasexpired since the last received warning for the trunk zone. The warningtime period may be configured by a user to a desired length. If thewarning time period has expired, this may indicate an intrusion attempton a separate zone in addition to an intrusion attempt on the trunk zoneand the system proceeds to 809 to evaluate the alert as a standard zoneand returns to step 711.

If the system determines in 803 that the warning time period has notexpired, this may indicate that there is an alert in a zone inconjunction with the trunk zone and the system proceeds to 804. In 804,the system determines if the zone warning mode has been set to apredetermined setting. In one embodiment, the predetermined setting maybe ‘Warning with Trunk Zone’. In one embodiment, if the zone does nothave a warning mode of ‘Warning with Trunk Zone’ 804, the system setsthe warning mode to ‘Warning with Trunk Zone’ in 805 prior to movingonto 806. In 806, the system evaluates if all zones in the zone's zonegroup have warning modes set to ‘Warning with Trunk Zone’. In onescenario, if a cable in a riser closet is disturbed, the trunk cable andall of the cables that are monitoring the floors below will set offalerts. In this case, the floor cables will have a ‘Warning with TrunkZone’ status so the system can separate these from a user zone. If not,the system proceeds to 809 to evaluate the alert as a standard zone andreturns to step 711.

If all zones in the zone's zone group have warning modes set to ‘Warningwith Trunk Zone’, this may indicate that the entire zone group hasreceived alerts in conjunction with the trunk zone. In that instance,the system will not evaluate the alert as a standard zone, but insteadthe system may suppress it. The system then proceeds to 807 to determineif the zone is set to active status. If not, the system sets the zone toactive status in 808 and proceeds to continue to alert processing. Whilethe flowchart shown in FIG. 8 and described herein depicts an exemplaryworkflow for a trunk cable processing sub process, other workflowsarranged in a different order may be implemented.

Turning to FIG. 9, a flowchart for ‘create alarm’ sub process 900according to an embodiment is shown. A system may create an alarmaccording to ‘create alarm’ sub process 900 when a zone receives aboundary alert, when a zone receives multiple warnings above a criteria,or when a zone warning count exceeds a defined threshold for the zone.In 901, a system evaluates if a zone is a trunk zone. If the zone is atrunk zone, the system may retrieve the highest consecutive zone groupwith a warning mode of ‘Warning with Trunk Zone’ in 902. A system mayindicate this information in a case as described in more detail below.

A system may create and opens a case in 903. If a case was opened due toa boundary alert, a system may notate the case accordingly. In 904, asystem may notify a personnel related to a zone. If a case was openeddue to a boundary alert, a system may notate the notificationaccordingly. In 905, a system may determine if a zone is configured todisable data. If yes, the system may perform a disable data sub process1000. In 906, a system may determine if a zone is configured to update aphysical security device. If yes, the system may perform the actionbased on a zone setting by sending a command to the physical securitydevice management platform in 907. In 908, a system may determine if azone is configured to re-route network data. If yes, the systemre-routes data based on a zone setting by sending a command to anoptical circuit switch in 909. In 910, a system may determine if a zoneis configured to perform network analysis. If yes, the system performsan action based on a zone setting by sending a command to an opticaltest access point in 911. A system may communicate with a networkanalytic tool based on a defined action. While the flowchart shown inFIG. 9 and described herein depicts an exemplary workflow for a createalarm sub process, other workflows arranged in a different order may beimplemented.

In FIG. 10, a flowchart for ‘disable data’ sub process 1000 according toan embodiment is shown. In 1001, a system may evaluate a zone type. In1002, if a zone is an outside plant zone, the system may collect allzones in a same data zone as the outside plant zone. The system may thenproceeds to 1006 to disable data in all of these zones.

In 1003, a system may evaluate if a zone is a trunk zone. If yes, thesystem collects all zones up to and including the highest consecutivezone group with a warning mode of ‘Warning with Trunk Zone’ in 1004. Thesystem may then proceeds to 1006 to disable data in all of these zones.In 1003, if a system determines that a zone is not a trunk zone but is auser zone, the system may retrieve the current zone in 1005 and proceedto disable data in this zone in 1006.

A system may be configured to disable data by directly communicatingwith an optical line terminal and/or network switch by sending a commandto the optical line terminal and/or network switch. A system may also beconfigured to disabled data by communicating with an optical circuitswitch by sending a command to the optical circuit switch. While theflowchart shown in FIG. 10 and described herein depicts an exemplaryworkflow for a disable data sub process, other workflows arranged in adifferent order may be implemented.

Turning to FIG. 11, a work flow for processing open warnings 1100according to an embodiment is shown. In 1101, on a defined interval, asystem may open all active warnings. In 1102, a system may determine ifa warning time period has elapsed since last receiving a warningtimestamp. If the warning time period has not elapse, the system mayproceed to 1103 and wait for a defined interval before returning tocheck all active warnings. If the warning time period has elapsed, thesystem may proceed to 1104 to determine if a zone is a trunk zone. Ifthe zone is not a trunk zone, the system may proceed to 1107 and closean active warning. If the zone is a trunk zone, the system may collectall zones up to and including the highest consecutive zone group with awarning mode of ‘Warning with Trunk Zone’ in 1105 and may then proceedto 1106. In 1106, a system may check if the trunk zone is alarmed. Ifnot, the system may close the active warning in 1107. In 1108, a systemmay set a zone warning count to zero. In 1109, a system may set a zonestatus to active monitoring. While the flowchart shown in FIG. 11 anddescribed herein depicts an exemplary workflow for processing openwarnings, other workflows arranged in a different order may beimplemented.

FIG. 12 shows a case resolution process according to an embodiment. In1203, when a case is created, a zone monitor 1201 may open the case andreview the case details. The case details displayed by a system mayinclude warning count, zone type, zone images, zone inspection guide,notified contact personnel, and status of the data network. A casedetail screen according to one embodiment is shown in FIG. 13.

In 1204, zone monitor 1201 may dispatch an investigator 1202 assigned toa zone. In 1206, zone monitor 1201 may record zone investigator's 1202name. In 1205, zone investigator 1202 may investigate a zone based on aStandard Operating Procedure defined by a system for a zone. In 1207,zone investigator 1202 may document evidence such as images or videos ofthe inspection. In 1208, upon completion of an investigation, zoneinvestigator 1202 may relay a full report in back to zone monitor 1201,including investigation evidence, a written report, and a finaldetermination. Final determinations may include items such as intrusion,accidental contact, unscheduled maintenance, natural disaster, and otheritems.

In 1209, zone monitor 1201 may record zone investigator's 1202 reportinto a system. In 1210, a system may enable zone monitor 1201 to resetmonitoring on a zone.

In 1211, when zone monitor 1201 resets monitoring on a zone, a systemmay check to see if data was disabled in a zone. If so, the system mayallow zone monitor 1201 to restore data to the zone in 1212. Zonemonitor 1201 may then restore data to the zone.

In 1213, a system may then close a case and track a time stamp for eachevent for audit and reporting purposes. While the workflow for a caseresolution process as shown in FIG. 12 and described herein depicts anexemplary workflow, other workflows arranged in a different order may beimplemented.

In an embodiment, when a case is open and under review, a system maycontinue to monitor for new alerts in a zone. FIG. 14 shows a flowchart1400 of a process for a system to continue monitoring during a casemanagement. In 1401, a system may determine if a new alert is detectedin a zone. In 1402, if a new alert is detected, the system may update aninterface with visual and audible indicators, such as an Eagle Eye Zonarwarning. This scenario may occur if an intrusion attempted iscontinuing. This process may provide an investigator situationalawareness and allow for additional safety or response measures.

In 1403, a system may require a user to notify an investigator of theEagle Eye Zonar warning. In 1404, a system may determine if a user hasnotified an investigator. If not, the system may return to 1403 torequire a user to notify an investigator. In 1405, after a user notifiesan investigator, the system may update a case note with information andtimestamp for the Eagle Eye warning detection and user acknowledgement.In 1406, a system may then allow a user to continue with a caseresolution process. While the flowchart shown in FIG. 14 and describedherein depicts an exemplary workflow for a process to continuemonitoring during a case management, other workflows arranged in adifferent order may be implemented.

According to an embodiment, a system may allow a user with anappropriate privilege the ability to modify a case resolution workflow.A system may allow for adding or removing steps into a workflow. Asystem may allow for routing and re-routing approval or disapprovalfunctions to a user, collection of users, roles or a collection of rolesin a system. Where appropriate, a system may allow for modification of aworkflow through a graphically based user interface.

In one embodiment, a system may be configured for predictive analysis. Asystem may calculate the captured alert signatures (duration, count,maximum/minimum/average power, etc.) for a case as well as an associatedcase resolution status. A system may provide artificial intelligencecapabilities in analyzing an alert signature and a resolution to computelikelihood scores for possible causes for an alert.

For a case, a system may use a predictive analysis to offer likelihoodscores on the case resolutions status. For each warning, a system mayprovide a real-time likelihood score for a cause of an alert.

Other features of a system may provide the ability to continuouslymonitor a given IP address range to discover and enroll unregisteredintrusion detectors. A system may allow a user to create a newenrollment task. An enrollment task may include:

-   -   Starting IP Address    -   Ending IP Address    -   Login ID for Intrusion Detector    -   Password for Login ID for Intrusion Detector    -   Frequency at which the Enrollment Task should run (Never, Daily,        Weekly)    -   SNMP Credentials for communication with the Intrusion Detector    -   Option to All Remote Reset of the Channel Ports of the Intrusion        Detector    -   Option to Disable Data in the Zones when an Alarm occurs    -   Warning Threshold Count    -   Warning Threshold Time Period    -   Alarm Response for Intrusion Alerts (None, Report, Report &        Halt, Halt)    -   Alarm Response for Boundary Alerts (None, Report, Report & Halt,        Halt)    -   Alarm Response for Smart Filter Detect Alerts (None, Report,        Report & Halt, Halt)    -   Device Availability Time Period

During enrollment, a system may query a discovered device and gatherdevice specific information such as the model and the port count of thedevice. A system may use the information to dynamically enroll thedevice. A system may provide the ability to discover a variety of devicemodels and types from one enrollment task.

After enrollment completes, a system may read an intrusion detectorthreshold setting. A system may disable monitoring on channel ports thatare determined to not have a fiber cable plugged into it. A system mayprovide a wizard based workflow to allow a user to provide additionalinformation to configure an enrolled device.

According to another embodiment, a system may provide the ability to seta specific channel port on an intrusion detector into a Learning Mode orAuto Configure. In this mode, an intrusion detector observes a fiber fora channel port for a configurable period of time to determine an optimalmonitoring parameter that may be used for monitoring intrusions,excessive optical gains/losses or environmental changes.

A system may be configured to allow a user with an appropriate privilegean option to perform Learning Mode. When the option is selected, thesystem may present an allowed user with a screen offering various timeperiods. When a user initiates a task in a system, the system sends anappropriate command to an intrusion detector to begin Learning Mode. Asystem may set the channel port Report only for any alert and not sendHalt alerts. At any time during Learning Mode, a system may allow a userto abort Learning Mode. A system may continue to receive a detectedalert during Learning Mode and may record the results in the system forfurther consideration by a user.

When Learning Mode completes, a system may receive a notification froman intrusion detector. A system may read and record a threshold settingdetermined during Learning Mode and associate the setting to a specificzone. A system may reset a channel port back from Report only to aprevious setting.

A system may read and record a current threshold setting of a channelport of an intrusion detector and associate the setting to a specificzone. For a setting, a system may indicate if the setting was Learned,set by Default, or set by a User.

A system may allow a user with an appropriate privilege the ability tosync a setting from a device to a system. A system may allow a user withan appropriate privilege the ability to edit any or all of the settings.When a user initiates a task in a system to update a setting, the systemmay send an appropriate command to an intrusion detector to update thesettings based on the user provided values. Any settings unchanged by auser remain unaffected.

A system may be deployed for various purposes. In one embodiment, asystem may be used to verify whether a data infrastructure is suitablefor alarmed carrier PDS. This testing process maybe used pre-deploymenton existing cables and conduit or during post-deployment testing processto validate new installations of alarmed cables and conduit.

While the invention has been described in detail with reference toparticularly preferred embodiments, those skilled in the art willappreciate that various modifications may be made thereto withoutsignificantly departing from the spirit and scope of the invention.

What is claimed:
 1. A method for managing a protective distributionsystem, comprising: monitoring a physical information transmission line;detecting, via one or more sensors, a disturbance on the physicalinformation transmission line, wherein the detected disturbance does notexceed a first preset threshold for triggering alerts of a first alerttype based on detected disturbances; determining, responsive to thedetection via the one or more sensors, a count for the number ofdisturbances within a preset time period that do not exceed the firstpreset threshold; determining whether the count, for the number ofdisturbances that do not exceed the first preset threshold, exceeds asecond preset threshold, wherein the second preset threshold correspondsto a preset number of allowable disturbances within the preset timeperiod; and triggering an alert of the first alert type responsive to adetermination that the count exceeds the second preset threshold.
 2. Themethod of claim 1, wherein (1) the detected disturbance is of a firstdisturbance type, (2) the first preset threshold is a threshold fortriggering alerts of the first alert type based on detected disturbancesof the first disturbance type, and (3) the second preset thresholdcorresponds to a preset number of allowable disturbances of the firstdisturbance type within the preset time period.
 3. The method of claim2, wherein the detected disturbance of the first disturbance typecomprises at least one of a vibration, a frequency change, an acousticchange, and a change in distance based on reflectometer reading, and adisturbance of a second disturbance type comprises at least a differentone of a vibration, a frequency change, an acoustic change, and a changein distance based on reflectometer reading.
 4. The method of claim 1,wherein the detected disturbance comprises a vibration-relateddisturbance, and wherein the first preset threshold is a threshold fortriggering alerts based on detected vibration-related disturbances. 5.The method of claim 1, wherein the detected disturbance comprises afrequency-change-related disturbance, and wherein the first presetthreshold is a threshold for triggering alerts based on detectedfrequency-change-related disturbances.
 6. The method of claim 1, whereinthe detected disturbance comprises an acoustic-change-relateddisturbance, and wherein the first preset threshold is a threshold fortriggering alerts based on detected acoustic-change-relateddisturbances.
 7. The method of claim 1, wherein the detected disturbancecomprises a disturbance related to a change in signal propagationdistance, and wherein the first preset threshold is a threshold fortriggering alerts based on detected disturbances related to a change insignal propagation distance.
 8. The method of claim 1, furthercomprising: initiating a response to the detected disturbance responsiveto the triggering of the alert of the first alert type, wherein theresponse comprises at least one of opening a case, dispatching aninvestigator to investigate the detected disturbance, and documentingthe investigation in the case.
 9. The method of claim 1, furthercomprising: initiating a response to the detected disturbance responsiveto the triggering of the alert of the first alert type, wherein theresponse comprises at least one of disabling a data collection,adjusting a physical security device, rerouting a data collection, andperforming network analysis.
 10. The method of claim 1, furthercomprising: causing the detected disturbance to be presented incomparison to the first preset threshold in real-time responsive to thedetection of the disturbance.
 11. The method of claim 1, wherein thecount is for the number of disturbances within the preset time periodthat do not exceed the first preset threshold, but exceeds a thirdpreset threshold.
 12. A system for managing a protective distributionsystem, comprising: a computer system comprises one or more processorsprogrammed to execute computer program instructions which, whenexecuted, cause the computer system to: monitor a physical informationtransmission line; detect, via one or more sensors, a disturbance on thephysical information transmission line, wherein the detected disturbancedoes not exceed a first preset threshold for triggering alerts of afirst alert type based on detected disturbances; determine, responsiveto the detection via the one or more sensors, a count for the number ofdisturbances within a preset time period that do not exceed the firstpreset threshold; determine whether the count, for the number ofdisturbances that do not exceed the first preset threshold, exceeds asecond preset threshold, wherein the second preset threshold correspondsto a preset number of allowable disturbances within the preset timeperiod; and trigger an alert of the first alert type responsive to adetermination that the count exceeds the second preset threshold. 13.The system of claim 12, further comprising: an intrusion detectorcoupled to the computer system, the disturbance is detected by thecomputer system via the intrusion detector.
 14. The system of claim 13,further comprising: an optical line terminal or network switch; anoptical circuit switch; an optical test access point device; a networkanalytic tool; and a video camera.
 15. The system of claim 12, wherein(1) the detected disturbance is of a first disturbance type, (2) thefirst preset threshold is a threshold for triggering alerts of the firstalert type based on detected disturbances of the first disturbance type,and (3) the second preset threshold corresponds to a preset number ofallowable disturbances of the first disturbance type within the presettime period.
 16. The system of claim 15, wherein the detecteddisturbance of the first disturbance type comprises at least one of avibration, a frequency change, an acoustic change, and a change insignal propagation distance, and a disturbance of a second disturbancetype comprises at least a different one of a vibration, a frequencychange, an acoustic change, and a change in signal propagation distance.17. The system of claim 12, wherein the computer system is furthercaused to: initiating a response to the detected disturbance responsiveto the triggering of the alert of the first alert type, wherein theresponse comprises at least one of opening a case, dispatching aninvestigator to investigate the detected disturbance, documenting theinvestigation in the case, disabling a data collection, adjusting aphysical security device, rerouting a data collection, and performingnetwork analysis.
 18. The system of claim 12, wherein the computersystem is further caused to: causing the detected disturbance to bepresented in comparison to the first preset threshold in real-timeresponsive to the detection of the disturbance.
 19. The system of claim12, wherein the count is for the number of disturbances within thepreset time period that do not exceed the first preset threshold, butexceeds a third preset threshold.
 20. A non-transitory computer-readablemedium for storing computer instructions therein, the computer-readablemedium comprising a set of instructions which when executed causes aprocessor to perform a method for managing a protective distributionsystem, the method comprising: monitoring a physical informationtransmission line; detecting, via one or more sensors, a disturbance onthe physical information transmission line, wherein the detecteddisturbance does not exceed a first preset threshold for triggeringalerts of a first alert type based on detected disturbances;determining, responsive to the detection via the one or more sensors, acount for the number of disturbances within a preset time period that donot exceed the first preset threshold; determining whether the count,for the number of disturbances that do not exceed the first presetthreshold, exceeds a second preset threshold, wherein the second presetthreshold corresponds to a preset number of allowable disturbanceswithin the preset time period; and triggering an alert of the firstalert type responsive to a determination that the count exceeds thesecond preset threshold.